aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
* implemented refresh rowDave Cramer2002-06-16
|
* Remove KSQO from GUC and move file to _deadcode.Bruce Momjian2002-06-16
|
* Fix up memory leakage created by recent changes.Tom Lane2002-06-15
|
* Clean up gcc warnings. Avoid the bad habit of putting externs in .cTom Lane2002-06-15
| | | | | | files rather than a header file where they belong. Pay some modicum of attention to picking global routine names that aren't likely to conflict with surrounding applications.
* Fix up gcc warnings, improve comments.Tom Lane2002-06-15
|
* Patch for current_schemas to optionally include implicit ...Bruce Momjian2002-06-15
| | | | | | | | Second cut attached. This one just adds a boolean option to the existing function to indicate that implicit schemas are to be included (or not). I remembered the docs as well this time :-) Dave Page
* PATCH SSL_pending() checks in libpq/fe-misc.c:Bruce Momjian2002-06-15
| | | | | | | | | | I am no longer pursuing a total non-blocking implementation. I haven't found a good way to test it with the type of work that I do with PostgreSQL. I do use blocking SSL sockets with this mod and have had no problem whatsoever. The bug that I fixed in this patch is exceptionally hard to reproduce reliably. Jack Bates
* WriteBuffer return value:Bruce Momjian2002-06-15
| | | | | | | >I'd vote for changing WriteBuffer to >return void, and have it elog() on bad argument. Manfred Koizar
* Remove some pre-WAL relics:Bruce Momjian2002-06-15
| | | | | | | | | SharedBufferChanged BufferRelidLastDirtied BufferTagLastDirtied BufferDirtiedByMe Manfred Koizar
* This patch wraps all accesses to t_xmin, t_cmin, t_xmax, and t_cmax inBruce Momjian2002-06-15
| | | | | | | | | | | HeapTupleHeaderData in setter and getter macros called HeapTupleHeaderGetXmin, HeapTupleHeaderSetXmin etc. It also introduces a "virtual" field xvac by defining HeapTupleHeaderGetXvac and HeapTupleHeaderSetXvac. Xvac is used by VACUUM, in fact it is stored in t_cmin. Manfred Koizar
* Fix for TAB completion using GRANT DELETE in psql.Bruce Momjian2002-06-15
| | | | Oliver Elphick
* The macaddr datatype understands most formats of MAC address, except 12Bruce Momjian2002-06-15
| | | | | | | hex digits with no separators, eg 00AABBCCDDEE. This is easily remedied with the following patch (against 7.2.1): Mike Wyer
* Noted with versions 7.0.3, 7.1.3, and 7.2.1:Bruce Momjian2002-06-15
| | | | | | | | | The psql interpreter becomes unstable if variable substitutions are used. The debugger GDB was unable to help however mpatrol reports that the sprintf at mainloop.c:389 is steping one byte farther than the allocation. William K. Volkman
* The method PgLargeObject::LOid() is missing an implementation in the .ccBruce Momjian2002-06-15
| | | | | | | | | | | | | | | | | | | | | | file. The program seems to compile ok, but when linking a program that uses the call, g++ chokes with an undefined reference error. If you know how this problem might be fixed, list the solution below: --------------------------------------------------------------------- I include the code: Oid PgLargeObject::LOid(){ return pgObject; } in the .cc file. Chris Traylor
* Add C++ indent tool.Bruce Momjian2002-06-15
|
* This patch fixes a few minor problems with libpq++: remove the deprecatedBruce Momjian2002-06-15
| | | | | | | | | | | PQExec(" ") in the wrapper around PQnotifies(), fix the Makefile for the examples so that they will actually compile properly (with the exception of #5, which depends on internal headers), make a minor change to libpq++.h so that "make examples" now works on my machine, update some documentation, fix some grammatical problems, and remove some of the more hideous comments. Neil Conway
* Add LOCALTIME and LOCALTIMESTAMP functions per SQL99 standard.Thomas G. Lockhart2002-06-15
| | | | | | | | | | | Remove ODBC-compatible empty parentheses from calls to SQL99 functions for which these parentheses do not match the standard. Update the ODBC driver to ensure compatibility with the ODBC standard for these functions (e.g. CURRENT_TIMESTAMP, CURRENT_USER, etc). Include a new appendix in the User's Guide which lists the labeled features for SQL99 (the labeled features replaced the "basic", "intermediate", and "advanced" categories from SQL92). features.sgml does not yet split this list into "supported" and "unsupported" lists.
* Search the existing regular expression cache as a ring buffer.Thomas G. Lockhart2002-06-15
| | | | | | | | | Will optimize the case for repeated calls for the same expression, which seems to be the most common case. Formerly, always searched from the first entry. May want to look at the least-recently-used algorithm to make sure it is identifying the right slots to reclaim. Seems silly to do math when it seems that we could simply use an incrementing counter...
* Make encryption of stored passwords the default, as discussed months ago.Bruce Momjian2002-06-15
|
* Remove pfrees of cached pg_pwd file, per Tom Lane.Bruce Momjian2002-06-15
|
* added empty result set testingDave Cramer2002-06-14
|
* added empty result set testingDave Cramer2002-06-14
|
* Yet another SSL patch. :-) This one adds some informational messagesBruce Momjian2002-06-14
| | | | | | | | | | | on the server, if DebugLvl >= 2. The patch also includes a late addition to the last patch (X509_check_private_key()). I'm not sure why it the currect revision wasn't tagged. Bear Giles
* SSL patch that adds support for optional client certificates.Bruce Momjian2002-06-14
| | | | | | | | | | | | | | | If the user has certificates in $HOME/.postgresql/postgresql.crt and $HOME/.postgresql/postgresql.key exist, they are provided to the server. The certificate used to sign this cert must be known to the server, in $DataDir/root.crt. If successful, the cert's "common name" is logged. Client certs are not used for authentication, but they could be via the port->peer (X509 *), port->peer_dn (char *) or port->peer_cn (char *) fields. Or any other function could be used, e.g., many sites like the issuer + serial number hash. Bear Giles
* Patch that checks ownership and permissions on server staticBruce Momjian2002-06-14
| | | | | | | private key. (You want it to be a regular file owned by the database process, with 0400 or 0600 permissions.) Bear Giles
* SSL patch to periodically renegotiate session key.Bruce Momjian2002-06-14
| | | | | | | | | In order to reduce the risk of cryptanalysis during extended sessions (or brief ones involving a substantial amount of data), this patch renegotiates the session key after 64kib has been transferred. Bear Giles
* SSL support for ephemeral DH keys.Bruce Momjian2002-06-14
| | | | | | | | | | | | As the comment headers in be-secure.c discusses, EPH preserves confidentiality even if the static private key (which is usually kept unencrypted) is compromised. Because of the value of this, common default values are hard-coded to protect the confidentiality of the data even if an attacker successfully deletes or modifies the external file. Bear Giles
* UPDATED PATCH:Bruce Momjian2002-06-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Attached are a revised set of SSL patches. Many of these patches are motivated by security concerns, it's not just bug fixes. The key differences (from stock 7.2.1) are: *) almost all code that directly uses the OpenSSL library is in two new files, src/interfaces/libpq/fe-ssl.c src/backend/postmaster/be-ssl.c in the long run, it would be nice to merge these two files. *) the legacy code to read and write network data have been encapsulated into read_SSL() and write_SSL(). These functions should probably be renamed - they handle both SSL and non-SSL cases. the remaining code should eliminate the problems identified earlier, albeit not very cleanly. *) both front- and back-ends will send a SSL shutdown via the new close_SSL() function. This is necessary for sessions to work properly. (Sessions are not yet fully supported, but by cleanly closing the SSL connection instead of just sending a TCP FIN packet other SSL tools will be much happier.) *) The client certificate and key are now expected in a subdirectory of the user's home directory. Specifically, - the directory .postgresql must be owned by the user, and allow no access by 'group' or 'other.' - the file .postgresql/postgresql.crt must be a regular file owned by the user. - the file .postgresql/postgresql.key must be a regular file owned by the user, and allow no access by 'group' or 'other'. At the current time encrypted private keys are not supported. There should also be a way to support multiple client certs/keys. *) the front-end performs minimal validation of the back-end cert. Self-signed certs are permitted, but the common name *must* match the hostname used by the front-end. (The cert itself should always use a fully qualified domain name (FDQN) in its common name field.) This means that psql -h eris db will fail, but psql -h eris.example.com db will succeed. At the current time this must be an exact match; future patches may support any FQDN that resolves to the address returned by getpeername(2). Another common "problem" is expiring certs. For now, it may be a good idea to use a very-long-lived self-signed cert. As a compile-time option, the front-end can specify a file containing valid root certificates, but it is not yet required. *) the back-end performs minimal validation of the client cert. It allows self-signed certs. It checks for expiration. It supports a compile-time option specifying a file containing valid root certificates. *) both front- and back-ends default to TLSv1, not SSLv3/SSLv2. *) both front- and back-ends support DSA keys. DSA keys are moderately more expensive on startup, but many people consider them preferable than RSA keys. (E.g., SSH2 prefers DSA keys.) *) if /dev/urandom exists, both client and server will read 16k of randomization data from it. *) the server can read empheral DH parameters from the files $DataDir/dh512.pem $DataDir/dh1024.pem $DataDir/dh2048.pem $DataDir/dh4096.pem if none are provided, the server will default to hardcoded parameter files provided by the OpenSSL project. Remaining tasks: *) the select() clauses need to be revisited - the SSL abstraction layer may need to absorb more of the current code to avoid rare deadlock conditions. This also touches on a true solution to the pg_eof() problem. *) the SIGPIPE signal handler may need to be revisited. *) support encrypted private keys. *) sessions are not yet fully supported. (SSL sessions can span multiple "connections," and allow the client and server to avoid costly renegotiations.) *) makecert - a script that creates back-end certs. *) pgkeygen - a tool that creates front-end certs. *) the whole protocol issue, SASL, etc. *) certs are fully validated - valid root certs must be available. This is a hassle, but it means that you *can* trust the identity of the server. *) the client library can handle hardcoded root certificates, to avoid the need to copy these files. *) host name of server cert must resolve to IP address, or be a recognized alias. This is more liberal than the previous iteration. *) the number of bytes transferred is tracked, and the session key is periodically renegotiated. *) basic cert generation scripts (mkcert.sh, pgkeygen.sh). The configuration files have reasonable defaults for each type of use. Bear Giles
* Back out SSL changes. Newer patch available.Bruce Momjian2002-06-14
|
* Attached are a revised set of SSL patches. Many of these patchesBruce Momjian2002-06-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | are motivated by security concerns, it's not just bug fixes. The key differences (from stock 7.2.1) are: *) almost all code that directly uses the OpenSSL library is in two new files, src/interfaces/libpq/fe-ssl.c src/backend/postmaster/be-ssl.c in the long run, it would be nice to merge these two files. *) the legacy code to read and write network data have been encapsulated into read_SSL() and write_SSL(). These functions should probably be renamed - they handle both SSL and non-SSL cases. the remaining code should eliminate the problems identified earlier, albeit not very cleanly. *) both front- and back-ends will send a SSL shutdown via the new close_SSL() function. This is necessary for sessions to work properly. (Sessions are not yet fully supported, but by cleanly closing the SSL connection instead of just sending a TCP FIN packet other SSL tools will be much happier.) *) The client certificate and key are now expected in a subdirectory of the user's home directory. Specifically, - the directory .postgresql must be owned by the user, and allow no access by 'group' or 'other.' - the file .postgresql/postgresql.crt must be a regular file owned by the user. - the file .postgresql/postgresql.key must be a regular file owned by the user, and allow no access by 'group' or 'other'. At the current time encrypted private keys are not supported. There should also be a way to support multiple client certs/keys. *) the front-end performs minimal validation of the back-end cert. Self-signed certs are permitted, but the common name *must* match the hostname used by the front-end. (The cert itself should always use a fully qualified domain name (FDQN) in its common name field.) This means that psql -h eris db will fail, but psql -h eris.example.com db will succeed. At the current time this must be an exact match; future patches may support any FQDN that resolves to the address returned by getpeername(2). Another common "problem" is expiring certs. For now, it may be a good idea to use a very-long-lived self-signed cert. As a compile-time option, the front-end can specify a file containing valid root certificates, but it is not yet required. *) the back-end performs minimal validation of the client cert. It allows self-signed certs. It checks for expiration. It supports a compile-time option specifying a file containing valid root certificates. *) both front- and back-ends default to TLSv1, not SSLv3/SSLv2. *) both front- and back-ends support DSA keys. DSA keys are moderately more expensive on startup, but many people consider them preferable than RSA keys. (E.g., SSH2 prefers DSA keys.) *) if /dev/urandom exists, both client and server will read 16k of randomization data from it. *) the server can read empheral DH parameters from the files $DataDir/dh512.pem $DataDir/dh1024.pem $DataDir/dh2048.pem $DataDir/dh4096.pem if none are provided, the server will default to hardcoded parameter files provided by the OpenSSL project. Remaining tasks: *) the select() clauses need to be revisited - the SSL abstraction layer may need to absorb more of the current code to avoid rare deadlock conditions. This also touches on a true solution to the pg_eof() problem. *) the SIGPIPE signal handler may need to be revisited. *) support encrypted private keys. *) sessions are not yet fully supported. (SSL sessions can span multiple "connections," and allow the client and server to avoid costly renegotiations.) *) makecert - a script that creates back-end certs. *) pgkeygen - a tool that creates front-end certs. *) the whole protocol issue, SASL, etc. *) certs are fully validated - valid root certs must be available. This is a hassle, but it means that you *can* trust the identity of the server. *) the client library can handle hardcoded root certificates, to avoid the need to copy these files. *) host name of server cert must resolve to IP address, or be a recognized alias. This is more liberal than the previous iteration. *) the number of bytes transferred is tracked, and the session key is periodically renegotiated. *) basic cert generation scripts (mkcert.sh, pgkeygen.sh). The configuration files have reasonable defaults for each type of use. Bear Giles
* Add support for GB18030Tatsuo Ishii2002-06-14
|
* Suppress 'owner of datatype appears to be invalid' warning message forTom Lane2002-06-13
| | | | undefined (shell) types.
* Allow ANALYZE to run in a transaction.Bruce Momjian2002-06-13
|
* Make WHERE conditions pulled up from subqueries be executed before outerTom Lane2002-06-13
| | | | WHERE conditions, if there is no reason to do it differently.
* removed personal test parametersDave Cramer2002-06-13
|
* Add PLACING to the list of reserved keywords. Added as a token in the lastThomas G. Lockhart2002-06-13
| | | | update to support the new OVERLAY() function.
* Added test for newly implemented updateable result setsDave Cramer2002-06-13
|
* changes to accomodate updateable resultset mostly just call setSqlQuery on ↵Dave Cramer2002-06-13
| | | | execute
* Implemented updateable result sets based on raghu nidagal implementationDave Cramer2002-06-13
|
* changed some commented out messages to use the Driver.debug and fixed first ↵Dave Cramer2002-06-13
| | | | to read the underlying data into rowbuffer
* added messages for updateable result setsDave Cramer2002-06-13
|
* Add GB18030 support. Contributed by Bill Huang <bill_huanghb@ybb.ne.jp>Tatsuo Ishii2002-06-13
| | | | (ODBC support has not been committed yet. left for Hiroshi...)
* make namein multibyte awareTatsuo Ishii2002-06-13
|
* Further tweaks to support display of sort keys in EXPLAIN --- initialTom Lane2002-06-13
| | | | implementation didn't work for Sort nodes associated with Append plans.
* Repair for bug #691 --- CREATE TABLE AS column aliases fail to beTom Lane2002-06-13
| | | | | | | | | applied when the select is a UNION (or other set-operation). An alternative route to a fix would be to leave analyze.c alone and change plan_set_operations in prepunion.c to take column names from the topmost targetlist. But I am not sure that would work in all cases. This patch seems the minimum-risk fix.
* Applied Lee Kindness' patch to fix one of memory allocation with floating ↵Michael Meskes2002-06-12
| | | | point numbers.
* 1) Fix a bug *double error message*.Hiroshi Inoue2002-06-12
| | | | | 2) Fix a bug *passowrd prompt in case of md5 authentication*. 3) Improve the DSN setup dialog.
* Allow createdb to create comments in current db, not template1.Bruce Momjian2002-06-11
|
* Implement SQL99 OVERLAY(). Allows substitution of a substring in a string.Thomas G. Lockhart2002-06-11
| | | | | | | | | | | Implement SQL99 SIMILAR TO as a synonym for our existing operator "~". Implement SQL99 regular expression SUBSTRING(string FROM pat FOR escape). Extend the definition to make the FOR clause optional. Define textregexsubstr() to actually implement this feature. Update the regression test to include these new string features. All tests pass. Rename the regular expression support routines from "pg95_xxx" to "pg_xxx". Define CREATE CHARACTER SET in the parser per SQL99. No implementation yet.
* Katherine Ward wrote:Jan Wieck2002-06-11
| | | | | | | | | | | | | | > Changes to avoid collisions with WIN32 & MFC names... > 1. Renamed: > a. PROC => PGPROC > b. GetUserName() => GetUserNameFromId() > c. GetCurrentTime() => GetCurrentDateTime() > d. IGNORE => IGNORE_DTF in include/utils/datetime.h & utils/adt/datetim > > 2. Added _P to some lex/yacc tokens: > CONST, CHAR, DELETE, FLOAT, GROUP, IN, OUT Jan
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-19 05:34:51 +0000